Starting System Logging Service... Starting getty on tty2-tty6 if dbus and logind are not available... Starting Permit User Sessions... [ OK ] Started Daily Cleanup of Temporary Directories. [ OK ] Reached target Timers. [ OK ] Started System Logging Service. [ OK ] Found device /dev/ttyS0. [ OK ] Started Permit User Sessions. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.38' (ECDSA) to the list of known hosts. 2020/09/09 08:02:57 parsed 1 programs 2020/09/09 08:02:57 executed programs: 0 syzkaller login: [ 65.724168][ T28] audit: type=1400 audit(1599638577.601:8): avc: denied { execmem } for pid=6858 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 66.888755][ T6859] IPVS: ftp: loaded support on port[0] = 21 [ 67.029799][ T6859] chnl_net:caif_netlink_parms(): no params data found [ 67.081557][ T6859] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.089413][ T6859] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.097826][ T6859] device bridge_slave_0 entered promiscuous mode [ 67.108141][ T6859] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.115519][ T6859] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.123123][ T6859] device bridge_slave_1 entered promiscuous mode [ 67.143422][ T6859] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.155167][ T6859] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.181524][ T6859] team0: Port device team_slave_0 added [ 67.189049][ T6859] team0: Port device team_slave_1 added [ 67.207236][ T6859] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.214379][ T6859] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.240709][ T6859] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.254682][ T6859] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.261618][ T6859] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.288058][ T6859] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.323452][ T6859] device hsr_slave_0 entered promiscuous mode [ 67.331420][ T6859] device hsr_slave_1 entered promiscuous mode [ 67.453210][ T6859] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.462957][ T6859] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.474135][ T6859] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.484793][ T6859] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.509193][ T6859] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.516396][ T6859] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.524088][ T6859] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.531145][ T6859] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.578834][ T6859] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.591989][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.602261][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.610595][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.618956][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 67.632664][ T6859] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.646154][ T6743] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.655231][ T6743] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.662281][ T6743] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.687362][ T2742] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.696924][ T2742] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.704020][ T2742] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.712934][ T2742] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.723152][ T2742] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.739465][ T6859] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 67.750118][ T6859] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.762988][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.771620][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.780541][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.790301][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.812102][ T6859] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.820849][ T7079] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 67.828459][ T7079] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 67.847501][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 67.867388][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 67.876035][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 67.883578][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 67.895557][ T6859] device veth0_vlan entered promiscuous mode [ 67.907376][ T6859] device veth1_vlan entered promiscuous mode [ 67.929248][ T7079] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 67.937689][ T7079] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 67.946477][ T7079] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 67.957079][ T6859] device veth0_macvtap entered promiscuous mode [ 67.968426][ T6859] device veth1_macvtap entered promiscuous mode [ 67.987492][ T6859] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.995256][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.005269][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.016410][ T6859] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.024524][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.033009][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.046308][ T6859] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.055166][ T6859] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.063935][ T6859] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.072616][ T6859] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.143653][ T7081] mmap: syz-executor.0 (7081) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 68.223051][ T7081] ================================================================== [ 68.223109][ T7081] BUG: KASAN: global-out-of-bounds in fbcon_resize+0x781/0x810 [ 68.223121][ T7081] Read of size 4 at addr ffffffff8896c2d8 by task syz-executor.0/7081 [ 68.223124][ T7081] [ 68.223137][ T7081] CPU: 1 PID: 7081 Comm: syz-executor.0 Not tainted 5.9.0-rc4-syzkaller #0 [ 68.223145][ T7081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.223150][ T7081] Call Trace: [ 68.223165][ T7081] dump_stack+0x198/0x1fd [ 68.223180][ T7081] ? fbcon_resize+0x781/0x810 [ 68.223192][ T7081] ? fbcon_resize+0x781/0x810 [ 68.223216][ T7081] print_address_description.constprop.0.cold+0x5/0x497 [ 68.223233][ T7081] ? fbcon_resize+0x781/0x810 [ 68.223248][ T7081] ? lockdep_hardirqs_off+0x96/0xd0 [ 68.223263][ T7081] ? vprintk_func+0x97/0x1a6 [ 68.223279][ T7081] ? fbcon_resize+0x781/0x810 [ 68.223291][ T7081] ? fbcon_resize+0x781/0x810 [ 68.223303][ T7081] kasan_report.cold+0x1f/0x37 [ 68.223318][ T7081] ? fbcon_resize+0x781/0x810 [ 68.223334][ T7081] fbcon_resize+0x781/0x810 [ 68.223354][ T7081] ? display_to_var+0x7b0/0x7b0 [ 68.223386][ T7081] ? vc_do_resize+0x2f6/0x1150 [ 68.223397][ T7081] ? __kmalloc+0x1c7/0x310 [ 68.223413][ T7081] ? display_to_var+0x7b0/0x7b0 [ 68.223427][ T7081] vc_do_resize+0x535/0x1150 [ 68.223459][ T7081] ? lock_downgrade+0x830/0x830 [ 68.223472][ T7081] ? check_preemption_disabled+0x50/0x130 [ 68.223484][ T7081] ? store_bind+0x6a0/0x6a0 [ 68.223499][ T7081] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 68.223514][ T7081] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 68.223535][ T7081] vt_ioctl+0x11d2/0x2cc0 [ 68.223550][ T7081] ? lock_release+0x1/0x8f0 [ 68.223563][ T7081] ? vt_waitactive+0x350/0x350 [ 68.223576][ T7081] ? check_preemption_disabled+0x50/0x130 [ 68.223587][ T7081] ? kfree+0x221/0x2b0 [ 68.223603][ T7081] ? tomoyo_path_number_perm+0x415/0x4d0 [ 68.223617][ T7081] ? lockdep_hardirqs_on+0x53/0x100 [ 68.223637][ T7081] ? tomoyo_path_number_perm+0x244/0x4d0 [ 68.223654][ T7081] ? tomoyo_execute_permission+0x470/0x470 [ 68.223670][ T7081] ? lock_is_held_type+0xbb/0xf0 [ 68.223685][ T7081] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 68.223701][ T7081] ? tty_jobctrl_ioctl+0x4d/0x1010 [ 68.223712][ T7081] ? vt_waitactive+0x350/0x350 [ 68.223730][ T7081] tty_ioctl+0x1019/0x15f0 [ 68.223754][ T7081] ? tty_fasync+0x390/0x390 [ 68.223768][ T7081] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 68.223785][ T7081] ? do_vfs_ioctl+0x27d/0x1090 [ 68.223800][ T7081] ? generic_block_fiemap+0x60/0x60 [ 68.223816][ T7081] ? selinux_inode_getsecctx+0x90/0x90 [ 68.223828][ T7081] ? _copy_to_user+0x126/0x160 [ 68.223856][ T7081] ? __fget_files+0x294/0x400 [ 68.223877][ T7081] ? bpf_lsm_file_ioctl+0x5/0x10 [ 68.223890][ T7081] ? tty_fasync+0x390/0x390 [ 68.223907][ T7081] __x64_sys_ioctl+0x193/0x200 [ 68.223925][ T7081] do_syscall_64+0x2d/0x70 [ 68.223940][ T7081] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.223951][ T7081] RIP: 0033:0x45d5b9 [ 68.223966][ T7081] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 68.223974][ T7081] RSP: 002b:00007f7e8d492c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.223988][ T7081] RAX: ffffffffffffffda RBX: 000000000001d000 RCX: 000000000045d5b9 [ 68.223996][ T7081] RDX: 0000000020000000 RSI: 0000000000005609 RDI: 0000000000000006 [ 68.224005][ T7081] RBP: 000000000118cf80 R08: 0000000000000000 R09: 0000000000000000 [ 68.224013][ T7081] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c [ 68.224022][ T7081] R13: 00007ffdad905aef R14: 00007f7e8d4939c0 R15: 000000000118cf4c [ 68.224045][ T7081] [ 68.224050][ T7081] The buggy address belongs to the variable: [ 68.224063][ T7081] font_vga_8x16+0x58/0x60 [ 68.224067][ T7081] [ 68.224071][ T7081] Memory state around the buggy address: [ 68.224082][ T7081] ffffffff8896c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 68.224092][ T7081] ffffffff8896c200: 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 [ 68.224102][ T7081] >ffffffff8896c280: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 [ 68.224108][ T7081] ^ [ 68.224117][ T7081] ffffffff8896c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 68.224126][ T7081] ffffffff8896c380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 68.224132][ T7081] ================================================================== [ 68.224136][ T7081] Disabling lock debugging due to kernel taint [ 68.225610][ T7081] Kernel panic - not syncing: panic_on_warn set ... [ 68.225625][ T7081] CPU: 1 PID: 7081 Comm: syz-executor.0 Tainted: G B 5.9.0-rc4-syzkaller #0 [ 68.225631][ T7081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.225634][ T7081] Call Trace: [ 68.225648][ T7081] dump_stack+0x198/0x1fd [ 68.225662][ T7081] ? fbcon_resize+0x720/0x810 [ 68.225673][ T7081] panic+0x347/0x7c0 [ 68.225693][ T7081] ? __warn_printk+0xf3/0xf3 [ 68.225708][ T7081] ? preempt_schedule_common+0x59/0xc0 [ 68.225717][ T7081] ? fbcon_resize+0x781/0x810 [ 68.225730][ T7081] ? preempt_schedule_thunk+0x16/0x18 [ 68.225743][ T7081] ? trace_hardirqs_on+0x55/0x220 [ 68.225754][ T7081] ? fbcon_resize+0x781/0x810 [ 68.225764][ T7081] ? fbcon_resize+0x781/0x810 [ 68.225775][ T7081] end_report+0x4d/0x53 [ 68.225786][ T7081] kasan_report.cold+0xd/0x37 [ 68.225798][ T7081] ? fbcon_resize+0x781/0x810 [ 68.225809][ T7081] fbcon_resize+0x781/0x810 [ 68.225823][ T7081] ? display_to_var+0x7b0/0x7b0 [ 68.225839][ T7081] ? vc_do_resize+0x2f6/0x1150 [ 68.225848][ T7081] ? __kmalloc+0x1c7/0x310 [ 68.225860][ T7081] ? display_to_var+0x7b0/0x7b0 [ 68.225871][ T7081] vc_do_resize+0x535/0x1150 [ 68.225891][ T7081] ? lock_downgrade+0x830/0x830 [ 68.225901][ T7081] ? check_preemption_disabled+0x50/0x130 [ 68.225911][ T7081] ? store_bind+0x6a0/0x6a0 [ 68.225922][ T7081] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 68.225934][ T7081] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 68.225947][ T7081] vt_ioctl+0x11d2/0x2cc0 [ 68.225958][ T7081] ? lock_release+0x1/0x8f0 [ 68.225974][ T7081] ? vt_waitactive+0x350/0x350 [ 68.225984][ T7081] ? check_preemption_disabled+0x50/0x130 [ 68.225993][ T7081] ? kfree+0x221/0x2b0 [ 68.226006][ T7081] ? tomoyo_path_number_perm+0x415/0x4d0 [ 68.226017][ T7081] ? lockdep_hardirqs_on+0x53/0x100 [ 68.226031][ T7081] ? tomoyo_path_number_perm+0x244/0x4d0 [ 68.226045][ T7081] ? tomoyo_execute_permission+0x470/0x470 [ 68.226058][ T7081] ? lock_is_held_type+0xbb/0xf0 [ 68.226070][ T7081] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 68.226083][ T7081] ? tty_jobctrl_ioctl+0x4d/0x1010 [ 68.226093][ T7081] ? vt_waitactive+0x350/0x350 [ 68.226105][ T7081] tty_ioctl+0x1019/0x15f0 [ 68.226119][ T7081] ? tty_fasync+0x390/0x390 [ 68.226130][ T7081] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 68.226142][ T7081] ? do_vfs_ioctl+0x27d/0x1090 [ 68.226154][ T7081] ? generic_block_fiemap+0x60/0x60 [ 68.226167][ T7081] ? selinux_inode_getsecctx+0x90/0x90 [ 68.226176][ T7081] ? _copy_to_user+0x126/0x160 [ 68.226192][ T7081] ? __fget_files+0x294/0x400 [ 68.226207][ T7081] ? bpf_lsm_file_ioctl+0x5/0x10 [ 68.226224][ T7081] ? tty_fasync+0x390/0x390 [ 68.226241][ T7081] __x64_sys_ioctl+0x193/0x200 [ 68.226254][ T7081] do_syscall_64+0x2d/0x70 [ 68.226265][ T7081] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.226274][ T7081] RIP: 0033:0x45d5b9 [ 68.226286][ T7081] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 68.226292][ T7081] RSP: 002b:00007f7e8d492c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.226303][ T7081] RAX: ffffffffffffffda RBX: 000000000001d000 RCX: 000000000045d5b9 [ 68.226310][ T7081] RDX: 0000000020000000 RSI: 0000000000005609 RDI: 0000000000000006 [ 68.226317][ T7081] RBP: 000000000118cf80 R08: 0000000000000000 R09: 0000000000000000 [ 68.226323][ T7081] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c [ 68.226331][ T7081] R13: 00007ffdad905aef R14: 00007f7e8d4939c0 R15: 000000000118cf4c [ 68.227467][ T7081] Kernel Offset: disabled [ 69.015459][ T7081] Rebooting in 86400 seconds..